summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--source4/ntvfs/common/brlock_tdb.c19
-rw-r--r--source4/ntvfs/ntvfs_generic.c6
2 files changed, 19 insertions, 6 deletions
diff --git a/source4/ntvfs/common/brlock_tdb.c b/source4/ntvfs/common/brlock_tdb.c
index 299400b96c..df95d4c4c6 100644
--- a/source4/ntvfs/common/brlock_tdb.c
+++ b/source4/ntvfs/common/brlock_tdb.c
@@ -80,6 +80,13 @@ struct brl_handle {
struct lock_struct last_lock;
};
+/* see if we have wrapped locks, which are no longer allowed (windows
+ * changed this in win7 */
+static bool brl_invalid_lock_range(uint64_t start, uint64_t size)
+{
+ return (size > 1 && (start + size < start));
+}
+
/*
Open up the brlock.tdb database. Close it down using
talloc_free(). We need the messaging_ctx to allow for
@@ -299,6 +306,10 @@ static NTSTATUS brl_tdb_lock(struct brl_context *brl,
kbuf.dptr = brlh->key.data;
kbuf.dsize = brlh->key.length;
+ if (brl_invalid_lock_range(start, size)) {
+ return NT_STATUS_INVALID_LOCK_RANGE;
+ }
+
if (tdb_chainlock(brl->w->tdb, kbuf) != 0) {
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
@@ -449,6 +460,10 @@ static NTSTATUS brl_tdb_unlock(struct brl_context *brl,
kbuf.dptr = brlh->key.data;
kbuf.dsize = brlh->key.length;
+ if (brl_invalid_lock_range(start, size)) {
+ return NT_STATUS_INVALID_LOCK_RANGE;
+ }
+
if (tdb_chainlock(brl->w->tdb, kbuf) != 0) {
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
@@ -620,6 +635,10 @@ static NTSTATUS brl_tdb_locktest(struct brl_context *brl,
kbuf.dptr = brlh->key.data;
kbuf.dsize = brlh->key.length;
+ if (brl_invalid_lock_range(start, size)) {
+ return NT_STATUS_INVALID_LOCK_RANGE;
+ }
+
dbuf = tdb_fetch(brl->w->tdb, kbuf);
if (dbuf.dptr == NULL) {
return NT_STATUS_OK;
diff --git a/source4/ntvfs/ntvfs_generic.c b/source4/ntvfs/ntvfs_generic.c
index d564db72ff..3319539b63 100644
--- a/source4/ntvfs/ntvfs_generic.c
+++ b/source4/ntvfs/ntvfs_generic.c
@@ -1116,12 +1116,6 @@ NTSTATUS ntvfs_map_lock(struct ntvfs_module_context *ntvfs,
isunlock = false;
}
for (i=0;i<lck->smb2.in.lock_count;i++) {
- if (lck->smb2.in.locks[i].length > 1 &&
- lck->smb2.in.locks[i].offset +
- lck->smb2.in.locks[i].length <
- lck->smb2.in.locks[i].offset) {
- return NT_STATUS_INVALID_LOCK_RANGE;
- }
if (lck->smb2.in.locks[i].flags == SMB2_LOCK_FLAG_NONE) {
return NT_STATUS_INVALID_PARAMETER;
}